A Cybersecurity Integration and Supply-Chain Verification Model for Shipboard Safety-Critical Systems Complying with IACS UR E26/E27

Chen-Yu Li; Chia-Ling Chen

doi:10.55524/ijircst.2026.14.6.3

Abstract

Application of IACS Unified Requirements E26 and E27 in the existing vessels creates a nightmare in terms of working. It is possible that the supplier is rated highly in documentations but the ship may end up having mechanical breakdown, having been associated with a bug that is hidden within OT software. We built the Supply-chain Verified Cyber Resilience (SCV-CR) framework to deal with this gap. Ranging the perimeter of otherwise-isolated networks into view instead of physical dependencies, SCV-CR imposes separation of communication paths and physical machinery dependencies on two explicit graph structures (G N and G S ) and imposes hard Boolean admission gates on signed SBOM and VEX artifacts. Our set-up of the deterministic Monte Carlo experiment took over 20,000 iterations and six representative Maritime subsystems (PMS, AMS, IAS, ECDIS, GMDSS and cargo automation). The disruption failure rates were reduced by 16.22 percent and conditional downtime reduced by 24.28 percent and the 95th-percentile recovery time reduced to 15.31 h over the simulated rollout. Because inherent physical hazard invariants are never eliminated by the framework, it appears to offer a verifiable, mathematically-underpinned, way of audit of cyber safety by shipboard engineers and classification surveyors when carrying out physical surveys of classes.

Keywords

Cyber-physical systems, IACS UR E26/E27, Maritime cybersecurity, Software bill of materials, Supply-chain verification.

References

International Maritime Organization, “Maritime cyber risk,” IMO Guidance Document, 2021. Available from: https://www.imo.org/en/OurWork/Security/Pages/Cyber-security.aspx
International Maritime Organization, “Maritime cyber risk management in safety management systems,” Resolution MSC.428(98), Jun. 2017. Available from: https://wwwcdn.imo.org/localresources/en/OurWork/Security/Documents/Resolution%20MSC.428(98).pdf
International Association of Classification Societies, “UR E26: Cyber resilience of ships,” Unified Requirements, Electrical and Electronic Installations, 2023. Available from: https://iacs.org.uk/resolutions/unified-requirements/ur-e
International Association of Classification Societies, “UR E27: Cyber resilience of on-board systems and equipment,” Unified Requirements, Electrical and Electronic Installations, 2023. Available from: https://iacs.org.uk/resolutions/unified-requirements/ur-e
BIMCO, International Chamber of Shipping, and collaborating organizations, The Guidelines on Cyber Security Onboard Ships, Version 4. Copenhagen: BIMCO, 2020. Available from: https://www.ics-shipping.org/publication/the-guidelines-on-cyber-security-onboard-ships/
K. Stouffer, M. Pease, C. Tang, T. Zimmerman, V. Pillitteri, and S. Lightman, “Guide to operational technology (OT) security,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-82 Rev. 3, 2023. Available from: https://csrc.nist.gov/pubs/sp/800/82/r3/final
International Electrotechnical Commission, Industrial Communication Networks—Network and System Security—Part 3-3: System Security Requirements and Security Levels, IEC 62443-3-3:2013, 2013. Available from: https://webstore.iec.ch/
International Electrotechnical Commission, Security for Industrial Automation and Control Systems—Part 4-1: Secure Product Development Lifecycle Requirements, IEC 62443-4-1:2018, 2018. Available from: https://webstore.iec.ch/
Cybersecurity and Infrastructure Security Agency, “ICS recommended practices,” CISA Industrial Control Systems, 2023. Available from: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
The MITRE Corporation, “ATT&CK: Enterprise matrix,” MITRE ATT&CK, 2023. Available from: https://attack.mitre.org/matrices/enterprise/
The MITRE Corporation, “ATT&CK: ICS matrix,” MITRE ATT&CK, 2023. Available from: https://attack.mitre.org/matrices/ics/
J. Boyens, A. Smith, N. Bartol, K. Winkler, A. Holbrook, and M. Fallon, “Cybersecurity supply chain risk management practices for systems and organizations,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-161 Rev. 1, 2022. Available from: https://csrc.nist.gov/pubs/sp/800/161/r1/final
Joint Task Force, “Security and privacy controls for information systems and organizations,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-53 Rev. 5, 2020. Available from: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
Joint Task Force Transformation Initiative, “Guide for conducting risk assessments,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-30 Rev. 1, 2012. Available from: https://csrc.nist.gov/pubs/sp/800/30/r1/final
R. Ross, V. Pillitteri, R. Graubart, D. Bodeau, and R. McQuaid, “Developing cyber-resilient systems: A systems security engineering approach,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-160, vol. 2, Rev. 1, 2021. Available from: https://csrc.nist.gov/pubs/sp/800/160/v2/r1/final
National Telecommunications and Information Administration, “The minimum elements for a software bill of materials (SBOM),” U.S. Department of Commerce, Report, 2021. Available from: https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
Cybersecurity and Infrastructure Security Agency, “Minimum requirements for Vulnerability Exploitability eXchange (VEX),” CISA Guidance, 2023. Available from: https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex
SPDX Project, “SPDX specification version 2.3,” Linux Foundation, 2022. Available from: https://spdx.github.io/spdx-spec/
OWASP Foundation, “CycloneDX specification overview,” OWASP Standard, 2023. Available from: https://cyclonedx.org/specification/overview/
S. Torres-Arias, H. Afzali, T. K. Kuppusamy, R. Curtmola, and J. Cappos, “in-toto: Providing farm-to-table guarantees for bits and bytes,” in Proc. 28th USENIX Security Symposium, 2019, pp. 1393–1410. Available from: https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias
OpenSSF, “Supply-chain Levels for Software Artifacts (SLSA) specification v1.0,” OpenSSF Standard, 2023. Available from: https://slsa.dev/spec/
Linux Foundation, “Sigstore documentation: Software signing and transparency,” 2023. Available from: https://docs.sigstore.dev/
J. Samuel, N. Mathewson, J. Cappos, and R. Dingledine, “Survivable key compromise in software update systems,” in Proc. 17th ACM Conference on Computer and Communications Security, 2010, pp. 61–72. Available from: https://doi.org/10.1145/1866307.1866315
Forum of Incident Response and Security Teams, “Common Vulnerability Scoring System version 4.0: Specification document,” FIRST, 2023. Available from: https://www.first.org/cvss/v4.0/specification-document
Forum of Incident Response and Security Teams, “Exploit Prediction Scoring System (EPSS) user guide,” FIRST, 2023. Available from: https://www.first.org/epss/
Cybersecurity and Infrastructure Security Agency, “Known exploited vulnerabilities (KEV) catalog,” CISA, 2023. Available from: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
M. Souppaya, K. Scarfone, and D. Dodson, “Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-218, 2022. Available from: https://csrc.nist.gov/pubs/sp/800/218/final
K. Dempsey, N. Chawla, A. Johnson, R. Johnston, A. Jones, A. Orebaugh, M. Scholl, and K. Stine, “Information security continuous monitoring (ISCM) for federal information systems and organizations,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-137, 2011. Available from: https://csrc.nist.gov/pubs/sp/800/137/final
I. Progoulakis, D. Nikitakos, and D. Dalaklis, “Cyber physical systems security for maritime assets,” Journal of Marine Science and Engineering, vol. 9, no. 12, p. 1384, 2021. Available from: https://www.mdpi.com/2077-1312/9/12/1384
E.-M. Kalogeraki, S. Papastergiou, H. Mouratidis, and N. Polemi, “A novel risk assessment methodology for SCADA maritime logistics environments,” Applied Sciences, vol. 8, no. 9, p. 1477, 2018. Available from: https://www.mdpi.com/2076-3417/8/9/1477
S. Katsikas, “Cyber security of the autonomous ship,” in Proc. 3rd ACM Cyber-Physical System Security Workshop, 2017, pp. 55–56. Available from: https://doi.org/10.1145/3055186.3055191
E. Liu, S. Dong, Z. Wu, and S. Zhang, “A PPO-based robust target pursuit framework for ASVs under cyberattacks,” in Proc. 2026 41st Youth Academic Annual Conference of Chinese Association of Automation (YAC), 2026, pp. 1270–1275. Available from: https://doi.org/10.1109/YAC71005.2026.11615513
M. Gao et al., “Swarm of MASSs cyber-security for anti-hijack system based on blockchain and chaotic-steganography using VRF-PBFT and encoder-decoder deep neural networks,” IEEE Transactions on Intelligent Transportation Systems, vol. 26, no. 12, pp. 21758–21768, 2025. Available from: https://doi.org/10.1109/TITS.2025.3616187
C. Chae, I. Kim, R. Baumler, and Y. Ahn, “Ship cybersecurity risk assessment for safe operation with human involvement: An experimental case study,” WMU Journal of Maritime Affairs, vol. 24, no. 4, pp. 515–543, 2024. Available from: https://doi.org/10.1007/s13437-024-00353-6
National Institute of Standards and Technology, “The NIST Cybersecurity Framework (CSF) 2.0,” NIST CSWP 29, Feb. 2024. Available from: https://www.nist.gov/cyberframework

Cites this article as

C. Li, C. Chen, "A Cybersecurity Integration and Supply-Chain Verification Model for Shipboard Safety-Critical Systems Complying with IACS UR E26/E27", International Journal of Innovative Research in Computer Science and Technology (IJIRCST), vol. 14, no. 6, pp. 20-29, 2026. doi: https://doi.org/10.55524/ijircst.2026.14.6.3

Corresponding Author

Chia-Ling Chen

Assistant Professor, Department of Maritime Police, Central Police University, Taoyuan, Taiwan

Download Full Paper

Download PDF

No. of Downloads: 3 | No. of Views: 29

A Cybersecurity Integration and Supply-Chain Verification Model for Shipboard Safety-Critical Systems Complying with IACS UR E26/E27

Citations

Total View 29

Total Download 3